cbce4555ff
TeamManager could not manage the roster: updateRule allowed self-update
only and deleteRule was superuser-only. The same self-update rule also
left a privilege escalation open — it did not restrict fields, so any
authenticated user could PATCH their own role to "admin".
- team_members rules (migration 1781000003 + base migration + setup
script mirror):
update: (@request.auth.id = id && @request.body.role:isset = false)
|| @request.auth.role = "admin"
delete: @request.auth.role = "admin"
Self-service onboarding keeps working (it never touches role); the
role field is admin-only; deletion is admin-only.
- pb_hooks/team_members.pb.js: the ENTRA_ADMIN_EMAILS resync is now
escalate-only — it guarantees admin for allow-list members on every
login but no longer demotes, otherwise every TeamManager promotion
would revert on the member's next sign-in (ADR-004 amended).
- TeamManager.jsx: info text updated to the new behaviour.
Verified with a two-identity mock-OIDC matrix (11/11): allow-list vs
regular login, self-escalation blocked while onboarding self-update
still works, cross-user update/delete blocked, admin promote/demote/
delete work, promotion survives the member's next login, allow-list
admin stays admin. Regression: #22 matrix 9/9, #24 matrix 8/8, #18
harness 15/15, npm test 112/112, eslint clean.
Closes #27
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
59 lines
2.4 KiB
JavaScript
59 lines
2.4 KiB
JavaScript
/// <reference path="../pb_data/types.d.ts" />
|
|
//
|
|
// Issue #16 — Auto-provisioning & role assignment for Azure (Entra ID) users.
|
|
//
|
|
// PocketBase auto-creates a `team_members` auth record on the first OIDC login
|
|
// (name is filled from the OIDC `name` claim via the collection's mappedFields).
|
|
// These hooks add the application-specific bits:
|
|
//
|
|
// * default `role` from an admin allow-list (env ENTRA_ADMIN_EMAILS),
|
|
// * default `enrollment_status = "not_started"` so new users go through the
|
|
// existing onboarding screen,
|
|
// * re-sync the admin role on every login so allow-list changes take effect
|
|
// without manual edits.
|
|
//
|
|
// The allow-list is a comma-separated list of e-mail addresses, e.g.:
|
|
// ENTRA_ADMIN_EMAILS=rve@respellion.nl,admin@respellion.nl
|
|
//
|
|
// resolveRole itself lives in pb_hooks/utils.js and is pulled in per-callback
|
|
// via require() — PocketBase's JSVM runs each hook callback below as its own
|
|
// isolated program, so a shared top-level function here would not be in scope
|
|
// at call time. See pb_hooks/utils.js for details. Keep the logic in sync with
|
|
// src/lib/azureAuth.js (resolveRole / parseAdminEmails), which carries the
|
|
// canonical, unit-tested version for the frontend/tests.
|
|
|
|
// On creation (first login): set defaults before the record is persisted.
|
|
onRecordCreate(function (e) {
|
|
const { resolveRole } = require(`${__hooks}/utils.js`);
|
|
const email = e.record.get("email") || "";
|
|
|
|
e.record.set("role", resolveRole(email));
|
|
|
|
if (!e.record.get("enrollment_status")) {
|
|
e.record.set("enrollment_status", "not_started");
|
|
}
|
|
|
|
// Fallback name when the IdP supplied no `name` claim.
|
|
if (!e.record.get("name")) {
|
|
e.record.set("name", email ? email.split("@")[0] : "Onbekend");
|
|
}
|
|
|
|
e.next();
|
|
}, "team_members");
|
|
|
|
// On every successful auth (incl. OIDC): guarantee the admin role for
|
|
// allow-list members. ESCALATE-ONLY (#27): the allow-list grants admin, it no
|
|
// longer demotes — otherwise every role promotion made through TeamManager
|
|
// would be reverted on the member's next login. Demotion runs through
|
|
// TeamManager; allow-list members cannot be demoted (the list wins on their
|
|
// next login).
|
|
onRecordAuthRequest(function (e) {
|
|
const { resolveRole } = require(`${__hooks}/utils.js`);
|
|
const email = e.record.get("email") || "";
|
|
if (resolveRole(email) === "admin" && e.record.get("role") !== "admin") {
|
|
e.record.set("role", "admin");
|
|
e.app.save(e.record);
|
|
}
|
|
e.next();
|
|
}, "team_members");
|